Moderate: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: mm: kmem: fix a NULL pointer dereference in objstockflushrequired CVE-2023-53401 kernel: RDMA/rxe: Fix incomplete state save in rxerequester CVE-2023-53539 kernel: RDMA/rxe: Fix mr-map...

Moderate: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: mm: kmem: fix a NULL pointer dereference in objstockflushrequired CVE-2023-53401 kernel: RDMA/rxe: Fix incomplete state save in...

RHEL 8 : kernel-rt (RHSA-2025:22800)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22800 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism...

RHEL 8 : kernel (RHSA-2025:22801)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22801 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: mm: kmem: fix a NULL pointer...

ALSA-2025:22800 Moderate: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: mm: kmem: fix a NULL pointer dereference in objstockflushrequired CVE-2023-53401 kernel: RDMA/rxe: Fix incomplete state save in...

PT-2025-49499

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The encryption algorithms within the kernel’s virt/coco/sev-guest component directly read from and write to shared unencrypted memory. This practice could potentially expose information...

ALSA-2025:22801 Moderate: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: mm: kmem: fix a NULL pointer dereference in objstockflushrequired CVE-2023-53401 kernel: RDMA/rxe: Fix incomplete state save in rxerequester CVE-2023-53539 kernel: RDMA/rxe: Fix mr-map...

EUVD-2025-201543

The Starter Templates plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.4.41. This is due to insufficient file type validation detecting WXR files, allowing double extension files to bypass sanitization while being accepted as a valid WXR file. Th...

CVE-2025-13065

The Starter Templates plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.4.41. This is due to insufficient file type validation detecting WXR files, allowing double extension files to bypass sanitization while being accepted as a valid WXR file. Th...

s390/ctcm: Fix double-kfree

...

drm/amdkfd: Fix double release compute pasid

...

SUSE CVE-2025-40219

In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Fix race between SR-IOV enable/disable and hotplug Commit 05703271c3cd "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" tried to fix a race between the VF removal inside sriovdelvfs and concurrent...

PT-2025-49358

Name of the Vulnerable Software and Affected Versions WordPress Starter Templates versions up to and including 4.4.41 Description The Starter Templates plugin for WordPress is susceptible to arbitrary file upload due to inadequate file type validation when handling WXR files. This allows files wi...

CVE-2025-40253

Double-free corruption occurs in the s390 CTC MPC driver when mpcrcvdsweepreq frees the mpcginfo structure, followed by ctcmpcunpackskb freeing the same pointer. Clang's static analyzer flagged this ownership confusion. The duplicate kfree corrupts slab metadata, potentially crashing the kernel o...

EUVD-2025-201353

The Demo Importer Plus plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 2.0.6. This is due to insufficient file type validation detecting WXR files, allowing double extension files to bypass sanitization while being accepted as a valid WXR file. Th...

CVE-2025-13066

CVE-2025-13066 refers to the WordPress plugin Demo Importer Plus (versions up to and including 2.0.6) with an authenticated file upload flaw: insufficient file-type validation allows WXR files, letting double-extension files bypass sanitization and upload arbitrary files. The vulnerability requir...

SUSE CVE-2025-40253

In the Linux kernel, the following vulnerability has been resolved: s390/ctcm: Fix double-kfree The function 'mpcrcvdsweepreqmpcginfo' is called conditionally from function 'ctcmpcunpackskb'. It frees passed mpcginfo. After that a call to function 'kfree' in function 'ctcmpcunpackskb' frees it...

ImageMagick < 6.9.13-34 / 7.x < 7.1.2-9 Use-After-Free / Double-Free (GHSA-q3hc-j9x5-mp9m)

The remote host has a version of ImageMagick installed that is prior to 6.9.13-34 or 7.1.2-9. It is, therefore, affected by use-after-free and double-free vulnerabilities as referenced in the GHSA-q3hc-j9x5-mp9m advisory. - ImageMagick is free and open-source software used for editing and...

CVE-2025-63896

An issue in the Bluetooth Human Interface Device HID of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to inject arbitrary keystrokes via a spoofed Bluetooth HID device...

CVE-2025-40253

In the Linux kernel, the following vulnerability has been resolved: s390/ctcm: Fix double-kfree The function 'mpcrcvdsweepreqmpcginfo' is called conditionally from function 'ctcmpcunpackskb'. It frees passed mpcginfo. After that a call to function 'kfree' in function 'ctcmpcunpackskb' frees it...